Backend Security Fundamentals

5.14.1Definition

Backend security is the set of practices protecting a system against unauthorized access, data exposure, and malicious input — distinct from authentication and authorization (5.2), which govern who can act; this chapter covers how the backend defends itself against attacks regardless of who is making the request.

5.14.2Why It Exists

A backend accepts input from the open internet, some of it necessarily untrusted and some actively hostile. Security practices exist because a system that only handles well-formed, honest input will eventually receive malformed or malicious input instead — from an attacker, a misbehaving client, or simple human error — and the consequences of trusting that input unconditionally range from data corruption to full system compromise.

5.14.3Core Threat Categories

• Injection (SQL, command) — untrusted input concatenated directly into a query or shell command instead of passed as a parameter, allowing an attacker to alter the query's meaning entirely.
• Cross-Site Scripting (XSS) — untrusted input rendered into a page without escaping, allowing an attacker's script to execute in another user's browser (relevant to every form, 3.8).
• Cross-Site Request Forgery (CSRF) — a malicious site tricking an authenticated user's browser into making an unwanted request, addressed by session/cookie hardening (5.3).
• Rate-limiting gaps — no limit on repeated requests to a sensitive endpoint (login, password reset), enabling brute-force or denial-of-service attacks.

5.14.4Common Mistakes

• String-concatenating user input into SQL queries instead of using parameterized queries or an ORM, the single most common cause of SQL injection.
• Trusting client-side validation as the only validation (3.8), with no server-side re-validation of the same input.
• No rate limiting on authentication endpoints, allowing unlimited automated login attempts.
• Verbose error messages exposing internal details (stack traces, database structure) to end users in production.

5.14.5Best Practices

• Use parameterized queries or an ORM exclusively — never build SQL via string concatenation with user input.
• Validate and sanitize every input server-side, regardless of what client-side validation already did.
• Rate-limit authentication and other sensitive endpoints by IP and/or account.
• Return generic error messages to clients in production; log detailed errors internally instead (5.13).